0

Got an interesting little issue. On one of our servers in particular, IIS 7.5 is not hiding the App_Data folder; it's serving it directly. Other servers don't have this problem, even if they're set up relatively similarly.

That folder obviously needs to be hidden. In fact, it's supposed to be fairly tricky to unhide it, if not basically disallowed altogether.

I ran a search for App_Data in Notepad++, to see if some web.config file or something had it mentioned (even though this should never be the case), and sure enough, there was no mention of it anywhere in the overall website's directory (except in extremely basic code that is not causing this). The app pool is DefaultAppPool, which should have relatively limited priveleges, and the Windows user permissions on the folder itself are set up the same way as they are with the other servers. As far as Googling this goes, any results are basically getting drowned out by people who are trying to make the directory visible, often while dealing with .NET code.

Where do you start in tracking down this issue?

Panzercrisis
  • 147
  • 7

1 Answers1

1

In IIS Manager select your site and double-click Request Filtering then select the Hidden Segments tab, you should see:

enter image description here

Make sure App_Data is there. The same setting exists on the server level.

If it is missing add it using the Add Hidden Segment... link in the actions panel on the right.

Peter Hahndorf
  • 13,763
  • 3
  • 37
  • 58